Splunk SOAR

Splunk SOAR App for CrowdSec. This App allows enrichment of IP addresses in an event investigation and playbooks with CrowdSec's CTI API.

This documentation will guide you through installing and configuring the app as well as showing an example of usage in which we'll show enrichment of IP addresses in an event investigation.

Setup

1. Navigate to apps page from your dashboard as shown in the image below.

2. Navigate to the new apps page by clicking on the New Apps button. Then search for "CrowdSec"

3. Click the Install button to install the app.

Configuring the App

1. Now the App should appear in the unconfigured apps.

2. Click on CONFIGURE NEW ASSET button.

3. Enter the required details like asset name etc in the Asset Info tab.

4. Navigate to Asset Setting pane, and enter your CrowdSec CTI API key. If you don't have one already see this guide to obtain one.

5. Click on the Save button to save the asset.

6. You can test this asset by clicking on the Test Connectivity button. If everything is configured properly, you should get a message like the one in the image.

Done, you've successfully configured the app. You can now use it in your playbooks and event investigations.

Example Usage

Here's an example of its usage in an event investigation.